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In this paper, we reconsider the communication model used in the no-go theorems on the impos- 
sibility of quantum bit commitment and oblivious transfer. We state that a macroscopic classical 
channel may not be replaced with a quantum channel which is used in the reduced model proving 
the no-go theorems. We show that in some restricted cases, the reduced model is insecure while the 
original model with a classical channel is secure. 



PACS numbers: 03.67.Dd, 03.67.Hk 
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I. INTRODUCTION 

The theorems on the security of quantum key dis- 
tribution P, following the first protocol of Bennett 
and Brassard and the theorems on the insecurity of 
two-party quantum bit commitment 0. 0- Q- oblivious 
transfer and general two-party quantum secure compu- 
tation 0| are among the most interesting subjects in the 
field of quantum cryptography. 

In a bit commitment protocol, Alice sends the commit- 
ment information about a secret bit to Bob, who cannot 
discover the bit, and when Alice is supposed to reveal 
the bit, Bob can detect if Alice changes the value of the 
bit. Oblivious transfer is a computation protocol where 
Alice enters two secret bits, Bob enters a choice to gain 
only one of these while Alice cannot know Bob's choice. 
Coin flipping is a protocol for Alice and Bob sharing a 
fairly random bits, i.e. none of the parties can affect the 
probability distribution of the outcome. 

These three primitives are used to construct secure 
computation for generic two-party functions @. Classi- 
cally, bit commitment implements coin flipping and is im- 
plemented by oblivious transfer , while oblivious trans- 
fer can be built from bit commitment by transmitting 
quantum information [TcLITlj. 

With the introduction of quantum information [T^ |. 
cryptographers were wil ling to build unconditionally se- 
cure bit commitment 0, ElL But the first no-go theorem 
eliminated these proposals This knock alerted peo- 

ple about the provable security of other two-party pro- 
tocols, including key distribution. While quantum key 
distribution is proved to be secure Q, Q , two other no-go 
theorems were issued: quantum secure two-party compu- 
tation and so oblivious transfer are impossible Q; quan- 
tum coin flipping with arbitrarily small bias is impossi- 
ble ^4[. We can add to the list another no-go result: 
quantum bit commitment cannot be built from coin flip- 
ping [13 . 

These no-go theorems execute the protocols on a quan- 
tum two-party model. This model is proposed first by 
Yao, and consists of a quantum machine on Alice side 
interacting with a quantum machine on Bob side via a 
quantum machine dHHa]. The global states, or images, 
of a protocol are then described in a joint space of Alice 



side Ha, Bob side Hb and the quantum channel He- The 
states of the execution can be mixed states, but all local 
random choice and computation made by Alice and Bob 
can be purified and kept at the quantum level 
The global state is then described by a pure state in a 
larger space Ha' ® He S^B' where Ha',Hb> are ex- 
tended from Ha,Hb to purify the random choices and 
measurements. Adopting the option that parts of the 
channel are controlled by one of the two participants, 
the no-go theorems converts the state of the joint com- 
putation (at a moment) into a bipartite state of joint 
space Ha" ®Hb" = (Ha 1 ® He a) ® {Hcb <£> Hb>) where 
He a, He b are the channel parts respectively controlled 
by Alice and Bob. In such a bipartite space, bit commit- 
ment and oblivious transfer are impossible. 

In this paper, I try to criticize the application of the no- 
go theorems to all possible two-party protocols, including 
quantum-classical mixed protocols. In fact, a specified 
protocol with classical messages would rather be imple- 
mented on a real physical model with a classical channel. 
We state that a classical channel can be macroscopic and 
cannot be controlled by any participants in terms of pu- 
rification. It should be viewed as a measurement which 
is trusted by both Alice and Bob. I give some restricted 
cases where the no-go theorems are valid with quantum 
communications but not with quantum-classical mixed 
communications. 

This critique is not to say that quantum bit commit- 
ment is possible. Indeed, another reconsideration of bit 
commitment on a complete model was made recently [rH |. 
and we should wait for reviews to confirm the results. 

First, in Section |nj we do a revision on the no-go the- 
orems of Mayers, Lo & Chau and the quantum model 
used in their proofs. With the same arguments, in Sec- 
tion [Oj we extend the no-go theorems with presence of 
a particular quantum trusted third-party. By this ex- 
tension of the no-go theorems for a particular quantum 
trusted third-party model, I show a result similar to [lfl| : 
bit commitment and oblivious transfer cannot be built 
upon coin flipping with purely quantum communications. 
Then, in Section we re-question about the arguments 
of Mayers, Lo & Chau in reducing general protocols from 
the mixed model with a classical channel to the purely 
quantum model. In that section, we propose a gener- 
alized model to adopt a real classical channel, and we 
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give a particular case-study where the no-go theorems 
are valid with purely quantum communications but not 
with mixed communications. 

In the following, we will use shortly "protocols" for 
all protocols with quantum-classical mixed communica- 
tions while "quantum protocols" for protocols with purely 
quantum communications. 



II. QUANTUM MODEL AND NO-GO 
THEOREMS 



A. Quantum model 

In f° r proving the security of bit-commitment- 

based quantum oblivious transfer, Yao defined a quan- 
tum two-party protocol as a pair of quantum machines 
interacting through a quantum channel. 

The protocol is then executed on a joint system con- 
sisting of Alice's machine TLa, Bob's machine TLb, and 
the quantum channel Tic- Initially, each participant pre- 
pares a state for its private system and the channel is 
in state |0). The execution is alternating rounds of one- 
way communications. For each round of one participant 
D G {A, B}, this performs a computation on the joint 
space of his private system TLd and the messages Tic- 
The messages will be taken to the location of the other 
for the next round. 



|00..0) 



I'll" 



foo.-o). 




FIG. 1: Quantum two-party model 



This model is general for all quantum protocols, and 
has been widely used for analyzing quantum protocols, 
e.g. the complexity of quantum communication [If! flftl ] 
and quantum interactive proofs 



B. No-go theorems 

The no-go theorems used the quantum model of Yao 
to prove the insecurity of two-party protocols. 

For protocols with quantum-classical mixed commu- 
nications, Yao said "Although the above description is 
general enough to incorporate classical computations and 
transmissions of classical information, it is useful to sep- 
arate out the classical parts in describing protocols" 
But his model was then widely used for all quantum- 
classical mixed protocols. The arguments is that a clas- 
sical bit can be transmitted as a qubit. Mayers explicitly 
explained this kind of quantum communication for clas- 
sical information Q. 

Because all random choices are made by either Alice or 
Bob, these two participant can keep the random choices 
at the quantum level by holding the entanglement with 
the quantum coins. Indeed, the fact that a participant 
purifies or not his random variables does not change the 
correctness of the protocol and the cheating strategy of 
the other. All of local computations can be also kept at 
the quantum level by delaying measurements to the final 
step. Thus, the global images of the the computation 
can be described by a pure state lying on a larger space 
purifying all local random variables and measurements: 
Ha' ® Tic ®TLb'- The execution of the protocol is then 
a well specified unitary transformation of the input state 
into the output state, and surprisingly deterministic. 

In the quantum model, at each moment between two 
rounds of communication, any quantum part of the chan- 
nel must lie on either Alice or Bob side. Thus, the global 
image at any moment can be considered as a state lying in 
a bipartite space Ha'^TLb" = Ha 1 ®TLca®TLcb®'Hb' 
where Hcd is for the channel part held by participant 
D G {A, B}. 

Then, at the considered moment, the partial images of 
the computations on Alice and Bob sides are 



P A =tr B "{p), 



p B " = tr A „{p), 



where p is the global image which is a pure state in the 
global space TLa" ®TLb" ■ 

For the security of bit commitment on Bob side, the 
partial images on Bob side at the moment before the 
opening phase must identical for the commitments of 
and 1: 

tr A "(po) = tr A "(pi)- 

The no-go theorem on bit commitment is issued by a the- 
orem that states that, in such a case, there exists a local 
unitary transformation on TLa" that transforms po to p\ . 
Alice can then switch the computation before opening 
the secret bit HQ. 

For the security of one-sided computation, Lo discov- 
ered that if the protocol is secure against Alice, then Bob 
has a local unitary transformation, independent from Al- 
ice's input, that helps Bob to learn the results computed 
from all of possible local inputs Q • 
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We revise here Lo's theorem for one-sided computa- 
tion. In fact, to compute f(i,j), Alice and Bob run to- 
gether a unitary U transformation on Alice's input \i) : 
i G {h, ..,i m } joint with Bob's input \j) : j G {ji, .., j n }. 
Other known local variables can be omitted without gen- 
eralization. At the end, Bob can learn the result from 
the output state \vij) = U(\i) A <%> \j) B ). But Alice can 
entangle her input A with a private quantum dice P, i.e. 
prepares the initial state ^= \i) p (8 |«a). 

If Bob inputs ji then the initial state for the protocol 

is 



si 



B • 



(1) 



and at the end, the output state is 

M = ~m H V) P ®u{\i A ) ® 

Similarly, if Bob inputs j'2 then the output state is 

= -sSl i >p®^(l*A)®li2) B )- 



For the security on Alice side, the partial images must 
be identical, i.e. 

tr B {\v n ) {v n \) = tr B {\v j2 ) (v h \) 

and then, there exists a local unitary transformation 
jj3i,32 on b od i oca i system such that 

M = U jl ' h \v n )- 

Therefore, because p (i\vj) = Wij), the transforma- 
tion JJ 31 ' 32 is universal for all Alice input i: 



JJ31 



Bob can enter computes \vij t ) and measures it to 
learn f(i,ji). However, to enable Bob to unambiguously 
get the result, \vij x ) must not be perturbed by his mea- 



by W 1 



mea- 



surement. Bob can transform it to \i 
sures to learn /(i, J2), and so on. 

More strongly, imperfect protocols are also banned 
from reaching an arbitrarily high security. There exist 
always a trade-off between the security on one side and 
the insecurity on the other side ■ 



III. EXTENSIONS OF NO-GO THEOREMS FOR 
THE QUANTUM MODEL 

In this section, we suppose an honest third-party that 
helps Alice and Bob to do some computations. We de- 
fine a quantum trusted third-party as a quantum device 
that can help Alice and Bob to do any required computa- 
tion. The third-party can used some local pure variables 
for the computations. The local variables of the trusted 



party are initialized to |0). At the end of the required 
computation, the third-party splits all of the outputs, in- 
cluded the local variables, into two parts, redirects one 
part to Alice, and one part to Bob, cf. figure[2 The exe- 
cution time of the computation done by the third-party is 
a elementary unit, and we can consider as it immediately 
returns the results to the participants. 



Alice's input 



Bob's input 




Alice's result 



Bob's result 



FIG. 2: The quantum trusted third-party 

With such a trusted third-party, we can extend the 
results of 0, 0, Q for the quantum model: 

Theorem 1 (Extension of no-go theorem on bit 
commitment). Quantum bit commitment is insecure 
even with help of the specified quantum trusted third- 
party. 

Theorem 2 (Extension of no-go theorem on secure 
computations). Quantum two-party secure computa- 
tions are insecure even with help of the specified quantum 
trusted third-party. 

In fact, when the third-party uses only pure states as 
local input, and immediately, splits and sends all of the 
qubits which participate to the computations to Alice 
and Bob, the global state at any considered moment is 
in some known pure state, according to the algorithm, 
in a bipartite space relating only Alice and Bob sides. 
Therefore, the no-go theorems remain valid. 

For example, to prove the later theorem for one-sided 
secure computation. We start with equation QJ. Attach- 
ing a pure state \0) A , B ,, locally prepared by the third- 
party, the initial state is 

I"')™ = -7= \*>p ® ® \h) B ® \o)a>b> ■ 

* i 

At the end of the computation, with help of the third- 
party, the combined system is in state 



-T 



i) P ®U(\i) A ® \h) B ® \Q) A , B ,) 



where system A' is set to A, system B' is set to B after 
the split. Therefore, the remaining arguments of Lo's 
proofs can be followed, cf. Section Til Bl 
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IV. IS COIN FLIPPING WEAKER THAN BIT 
COMMITMENT? 

As a corollary of the extensions of the no-go theorems, 
cf. Section Unl we conclude that 



Corollary 1. In the quantum model, Coin Flipping is 
weaker than Bit Commitment and Oblivious Transfer. 

In Kent shown a similar result. In his paper, he 
established a relativist model to implement coin flipping. 
With an assumed quantum trusted party, we made the 
model more comprehensible from a non-relativist point 
of view. 

It's because we can suppose a trusted third-party that 
creates a pair of qubits in Bell state l^-l-) and sends each 
part to an user. In such a model, coin flipping is realizable 
while bit commitment and oblivious transfer are not with 
quantum communication, as shown by Theorems El 



QUANTUM MODEL IS NOT TO PROVE 
THE INSECURITY 



A. Quantum-classical mixed model 

What is the difference between the two channel? A 
quantum channel is a medium that we can used to trans- 
mit directly a quantum state without disturbing it while 
a classical channel permits only one of two discrete values 
for a classical bit. For example a macroscopic electrical 
wire with tension +5V for and —5V for 1. It is natural 
that in reality, a classical channel is well coupled with the 
environment, and the decoherence is so strong that only 
|0) or |1) is accepted, in terms of quantum information. 

Imagine that in the specification of a protocol, at a 
certain moment, a party has to measure some results of 
its quantum computation and send the resulting classi- 
cal messages to the other party. With a macroscopic 
classical channel, the measurement must be carried out. 
The sender can also memorize the emitted message. It is 
convenient to see the classical channel as a trusted mea- 
surement machine: the sender sends the qubits to the 
machine that measures, doubles the output state, which 
is an eigenstate and cloneable, sends one copy to the re- 
ceiver and one copy back to the sender for memorizing 
it. 

Yao's model should be generalized for two-party proto- 
cols as a pair of quantum machines interacting through 
a quantum channel and necessarily a classical channel. 
The model is also alternating rounds of one-way com- 
munications. In each round, a participant D S {^4, B} 
performs a computation on the joint space of his pri- 
vate system Hd, the quantum messages He the classical 
messages Hr ku d received from the trusted measurement 
machine M, and the messages Hs m ,d to be sent to the 
measurement machine for producing classical messages. 

For simplifying, the measurement machine should not 
copy the output. This task can be carried out by the 



sender. In fact, measuring a state a |0) + b |1), the above 
machine produces |00) or |11). Instead, the sender can 
create a|00) + 1 11) , sends the first qubit to the ma- 
chine that measures it and sends the output state to the 
receiver. By this way, the sender keep a copy of the mea- 
surement. 

Therefore, the model is simplified, and consists of two 
machines Ha,Hb, a quantum channel He for both quan- 
tum and classical messages and a trusted measurement 
machine M with ancillas Hm- The measurement is in 
fact a CNOT-like gate whose controlling inputs are in 
the space of the sender's "classical messages" and targets 
are ancillas in the macroscopic environment space Hm, 
cf. figure 

In each communication round, a participant D e 
{A, B} does an unitary computation on Hd'®Hc where 
TLd' is extended from Hd to purify local variables and 
measurements; the trusted machine applies the CNOT 
gate to the "classical messages" in He and the environ- 
ment of the classical channel Hm. The quantum mes- 
sages and "classical messages" in He of the round are 
taken to the other location for the next round. Hm is 
not controlled by any participant. 




FIG. 3: Mixed model 



B. Is the reduction cogent? 

It is obvious that all protocols can be correctly im- 
plemented on the quantum model by replacing classical 
bits by qubits. By this way, a protocol is secure if its 
simulating quantum protocol is secure. It's reasonable to 
use simulating quantum protocols to prove the security of 
original protocols [ijj- But, vice- versa, it is not evident. 
Unfortunately, the no-go theorems used the simulating 
quantum protocols to prove the insecurity of original pro- 
tocols. 

For example, in the specification of a mixed protocol, a 
participant makes the measurement of its computation to 
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FIG. 4: Quantum vs. Mixed models 



produce a classical message, sends the messages via a the 
classical channel which reproduces a corresponding state 
in the computation basis for the other participant. In 
the model of the specification with a macroscopic channel 
for sending classical message, the receiver really receives 
one of the eigen-states of the measurement made by the 
sender. 

While, by simulating with a quantum channel, the 
sender equivalently creates a quantum mixed state as 
the sum of the above measurement eigen-states weighted 
by the corresponding probabilities. However, the sender 
can prepare this mixed state as part of a bipartite pure 
entangled state. We see this by citing to an early sim- 
ple example: at a certain moment, a participant gets 
a |0) + b |1), measures it and sends the result, either |0) 
with probability a 2 or |1) with probability b 2 . This clas- 
sical message is described in terms of quantum informa- 
tion as a 2 |0) (0| + & 2 |0) (0|. With a quantum channel, the 
sender can send (a \0)+b |l))(g)|0} c through a CNOT gate 
to make (a |0) g) |0) c + b |1) g> |l) c ) and send qubit C to 
the receiver. 

The above quantum communication of classical mes- 
sages gave to the participants an extra entanglement that 
does not exist in the specification of the protocol with 
mixed communications. Indeed, this entanglement could 
be used as a powerful attack. We will explicitly expose 
this with a case-study where, if the receiver used the re- 
ceived message to do some quantum computation and 
sends back the result, the sender could learn more infor- 
mation with entanglement attack by the effect of super- 
dense coding (2lT |. 

Such an bipartite entanglement should be destroyed by 
the measurement of the classical channel. In our model 
for the classical channel, the sender has to send qubit 
C to the measurement machine of the classical channel 
that makes instead the state (a |0) (g> |0) M ® |0) c + b |1) <8> 
|1) M (g> |l) c ) and sends qubit C to the receiver. 

From a global view, one can see that if the two par- 
ties follow a protocol using a defined classical channel, 
the global system should lie in a tripartite spaces joining 
Ha ® 'He, A, 'Hb® 7~(-c,b and TIm- The crucial argument 
that the whole system is described in a bipartite space, 
used in the proofs of the no-go theorems |j, OjUj], is not 
valid in the mixed model, cf. figure 0J 



All of the proposed quantum bit commitment proto- 
cols fall into the quantum model 0, 0, [22] , where all 
communications are realized with quantum messages ex- 
cept the final step to open the committed bit. Theruthey 
are directly attacked by the no-go theorems 0- 0| 

Maybe, unconditionally secure bit commitment is also 
impossible in the mixed model, as concluded by a recent 
study in a preprint paper of Mauro d'Ariano et al. [l7j . 
but the arguments used in Mayer and Lo & Chau proofs 
for all possible protocols are not evident. 

We think that, the insecurity of a protocol should be 
considered when implementing it on a quantum-classical 
mixed model that match better the real world. Normally, 
a macroscopic classical channel is coupled with a trusted 
environment and measures the quantum messages sent 
through it. We expect that, to be more convincing, no- 
go theorems should be proved for the mixed model we 
proposed in the previous section. 



C. Case-study: an honest third-party O-OT gate 

Let verify a quantum oblivious transfer protocol with 
a pure trusted party, cf. IIIII In our protocol, the pure 
trusted party uses tree local qubits. For simplifying, we 
initialize the first and the second qubit to be entangled 
and in state |<J>+). In fact, the trusted party can pre- 
pare this state from 1 00) by a doing n/2 rotation on the 
first qubit and sending the two qubit through CNOT gate 
whose target is the second qubit. The third qubit is ini- 
tialized to |0). 

Inspired from Bennett et al. j2^|, we use the notations: 

60=|#+) = (|00> + |11»/V2, 

oi = |*-) = (|oo)-|ii))/A 

10 = |*+) = (|01) + |10»/\/2, 

n = |*-) = (|oi)-|io))/V2. 

Let bo, b\ be the two bits that Alice want to send and 
c be Bob's choice. The trusted party does a controlled ir 
rotation Rb b 1 on the first qubit, according to bo,b\: 

Rao = I, Rqi = o~ z , Rio = cr x , Rn = a y - 



The first and second qubits are obtained in state 60^1 • 
Next, the trusted party applies the bilateral n/2 rotation 
By to the first and second qubits in case c = 1 [2^ |: 



00- 


By 


00, 


01 - 


~^By 


To, 


10- 


^By 


01, 


11 - 


By 


iT- 



The trusted party applies then the CNOT gate whose 
controlling input is the first qubit and the target is the 
third qubit. Finally, the trusted party splits the outputs, 
sends back Alice's qubits with his first local qubit to Al- 
ice, and sends back Bob's qubit with its second and third 
local qubits to Bob, cf. figure 00 



|0)t - 

l$* - 



Alice 



Bob 



V 



FIG. 5: A third-party gate for O-OT protocol 



In case Alice and Bob communicate with the trusted 
party via quantum channels, they can send directly quan- 
tum inputs. The computation of the trusted party is a 
quantum circuit acting on 6 qubits: two for Alice's in- 
puts, tree for the local qubits, one for Bob's input. Alice 
can prepare a superposition 



_(|00) + |01) + |10) + |11))- 



The global input state is then 



-(|00) , + \01) A + \10) A + |11).) |$+) T |0) T \c) 1 



If Bob sends |c) = |0) then the computation is 



Rb„ 



>CNOT 



If Bob sends 



>CNOT 



* split 



2V2 



-[|00) A 00 T 
+ |10) a 10 t 

-noo) A (|oo) T 



|01) A 01 T 



|H)aHt 



111) 



|0) T 10), 



2V2 



+ |01) A (|00) T -|11) T ) 

+ |10) A (|01) T + |10) T )+ 

|ll) A (|01) r -|10) T )]|0) T |0) fl 

|00) A (|000) T + |111) T ) 

lillU 



|01) A (|000) T 

|ioM|oio) T 
111 



HOI) 



2V2 



(|000) 



A (|010) T -|101) T )]|0) B 
1 + |010) A )|000) B 



1001) 



1011^)1110), 



+ (|100) A + |110) A )|100) B 
+ (|101) A -|lll) A )|010) fl ] 

|1) then the computation is 



2V2 



I[|00) A 00 T 
|10) A 10 T + 
r |00) A (|00) T 



|01) A 01, 



|0) 



|H)r) 



|01) A (|01) T + |10) T ) 
|10) A (|00) T -|11) T ) 



|11) A (|01) T -|10) T )]|0) T |1) B 



2V2 



|00) A (|000) T + |111) T ) 
1101), 



+ |01) A (|010) T 
+ |10) A (|000) T 

+ 111' 



1111) 



2V2 



(1000) 



A (|010) T -|101) T )]|1) B 
l + |100) A )|001) B 



1001) 



|101) A ) |111) B 



+ (|010) A + |110) A )|100) B 
+ (|011) A -|111) A )|011) B ]- 

We see that the reduced density matrices at Alice's loca- 
tion are different for the two cases, and so c is not secure 
against Alice. 

However, if Alice and Bob are subjected to send bo, b\, c 
to T via classical channels, cf. figure H3 The inputs 
will be measured and projected onto the computation 
basis. For example on Alice side, simply speaking, 
Alice inputs \bobi) can only take one of the 4 values 
|00) , 1 01) , 1 10) , 1 1 1 ) and for any of these cases, Alice can- 
not discover c. Using the defined model for the classi- 
cal channel, Alice sends her inputs through CNOT gates 
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1% - 



Alice 



Bub 



— 



M 



FIG. 6: Third-party gate for O-OT protocol with classical 
channels 



whose targets are in the measurement machine M of the 
classical channel. The output is entangled with M. The 
final states of the computations for c = and c = 1 are 



\OUtc] 



1 



2\/2 



(|000) A |00) M + |010) A |01) M )|000) i 



+(|001) A |00) A/ 
+(|100} A |10> M 
-(|101> A |10) M - 



-|011> A |01) M ) 
-|110) A |11) M ) 
|111} A |11) M )|010) B ], 



|110)b 
|100) B 



lout 1 



2V2 



(|000) A |00) M + |100) A |10> M )|001) 



(|001) A |00) A/ -|101) A |10) 



1111) 



+ (|010) A |01) M + |110} A |11} M )|100) B 
+(|011) A |01) M -|111) A |11) M )|011) B ]- 

The reduced matrices of tree qubits at Alice location are 
gained by tracing out M part and B part, and become 
1/8 for both two values of c. 

Similar analyses on Bob side shows that the protocol 
is also secure. Therefore, with help of classical commu- 
nications, the protocol becomes secure on both sides. 



VI. SUMMARY 

Our arguments were based on the difference between 
communicating classical information in a classical man- 
ner and in a quantum manner. 

The discussions take us back to a similar problem 
of Schrodinger's Cat J24[- Imagine that Alice owns a 
Schrodinger Box, and at a certain moment, has to tell 
Bob whether the cat is dead or alive. 

If Alice and Bob live in a same public environment, 
e.g. in a same room, Alice does this via a classical chan- 
nel, e.g. the acoustic channel: Alice has to open the box 
and sound what she sees. It is equivalent to as though 
they open the box together, cf. figure In another 
way, Alice can give the box to Bob and let him open 
it. However, Bob can open the box in a private environ- 
ment. We can say that Alice and Bob live in two separate 
quantum worlds. Imagine that Alice and Bob live in two 
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Alice 



■■" -% Bob 

\A_ 



M 
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FIG. 7: Telling the cat's state via a classical public environ- 
ment 



isolated rooms. Alice puts the observable hole of her box 
through the wall into Bob's room, and the two rooms re- 
main always isolated, cf. figure 03 It is as though Bob's 
measurement devices are thrown to a private quantum 
space. 



o 



Alice 



o 



Bob 





1 r 1 



















FIG. 8: Telling the cat's state via private environments 

We see that, within the classical concepts, a classical 
message transmitted from Alice to Bob must be "com- 
prehensible" by both parties in a same reference frame. 
It is due to a classical channel as a common environment 
that both Alice and Bob refer to. Classical information 
can be viewed as quantum information, but measured by 
this reference environment. All quantum measurement 
devices making classical messages in a protocol between 
Alice and Bob must be thrown to this trusted Hilbert 
space. In this paper, we have used these concepts of 
communication of classical information, as in the former 
case of telling the cat's state. 
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Nevertheless, in the purely quantum model used by 
Mayers and Lo & Chau, there is no such a common space, 
and the measurement devices of each party for mak- 
ing classical information are thrown to a private Hilbert 
space of that party Q. 

Another example is the difference between the result of 
the tossing of a classical random bit and the splitting of 
the EPR pair |<J>+). We see that the result of tossing of 
a random bit is a pair of (Oa, Ob) or (1a, Is) with equal 
probability 1/2. In terms of quantum information, the 
random bits are described by the density matrix: 

tab = \ \0 A B ) (0 a b \ + \ |Ulfl) (U1b| • 
On the other hand, the EPR pair is 

|*+) = i(|o A o B ) + |ui B )) 

The two states are indeed different. The EPR pair really 
implements the tossing only when Alice and Bob have 
a common reference, for example measurement devices 
coupled with a common environment that project each 
qubit to a same basis {|0),|1)}. This measurement is 
trusted by both party, and used as a Hilbert space Hm 
of reference, and the measurement devices can be thrown 
to it. The measurement of the EPR pair gives 

|V) = -^=(\0a0 b 0m) + \1 A 1b0m)), 



and Alice and Bob get exactly a pair of random bits tab ■ 

tr M (\i>) (VI) = \ \0 A B ) (0a0 b | + - |Ulfl) (l A ls| • 

With the above concepts of communicating classical 
information, we summarize that 

• A general protocol, specified with classical and 
quantum messages can be correctly implemented 
in the quantum model with only a quantum chan- 
nel. We can say that the original protocol is secure 
if the simulating protocol in the quantum model is 
secure. However, we have no right to use the simu- 
lating protocol in the quantum model to prove the 
insecurity of the original protocol. We should con- 
sider its insecurity in a model that would match 
better the real world with quantum and classical 
channels. 

• We supposed that a classical channel is normally 
well coupled with the environment and may not be 
controlled by neither Alice nor Bob. It is convenient 
to see it as a trusted measurement which sends back 
the classical outcomes to Alice and Bob. 

• We shown that in some special cases, the original 
protocol is secure in presence of a classical channel 
while its simulating protocol in the purely quantum 
model is insecure. 
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